Hunt List
12,256 network-exploitable high/critical CVEs ranked by bug bounty relevance. Sorted by attack surface, exploit availability, and exploitation probability.
| BB | CVE | CVSS | EPSS | Attack Surface | Flags | Description |
|---|---|---|---|---|---|---|
|
64
|
CVE-2026-59517 |
7.1 | 0.0025 | NET NO AUTH LOW CX | Unauthenticated Cross Site Scripting (XSS) in Easy Form Builder <= 4.0.12 versio | |
|
64
|
CVE-2026-61947 |
7.1 | 0.0025 | NET NO AUTH LOW CX | Unauthenticated Cross Site Scripting (XSS) in Form Vibes – Database Manager for | |
|
64
|
CVE-2026-65492 |
7.1 | 0.0025 | NET NO AUTH LOW CX | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti | |
|
64
|
CVE-2026-65510 |
7.1 | 0.0025 | NET NO AUTH LOW CX | Unauthenticated Cross Site Scripting (XSS) in PeproDev Ultimate Invoice <= 2.2.6 | |
|
64
|
CVE-2026-65511 |
7.1 | 0.0025 | NET NO AUTH LOW CX | Unauthenticated Cross Site Scripting (XSS) in Manual - Documentation, Knowledge | |
|
64
|
CVE-2026-59553 |
7.1 | 0.0025 | NET NO AUTH LOW CX | Unauthenticated Cross Site Scripting (XSS) in Product Feed Manager <= 7.6.1 vers | |
|
64
|
CVE-2026-59556 |
7.1 | 0.0025 | NET NO AUTH LOW CX | Unauthenticated Cross Site Scripting (XSS) in Dynamic Pricing With Discount Rule | |
|
64
|
CVE-2026-59558 |
7.1 | 0.0025 | NET NO AUTH LOW CX | Unauthenticated Cross Site Scripting (XSS) in Booking Calendar <= 11.4.2 version | |
|
64
|
CVE-2026-61957 |
7.1 | 0.0025 | NET NO AUTH LOW CX | Unauthenticated Cross Site Scripting (XSS) in miniorange otp verification <= 5.5 | |
|
64
|
CVE-2026-65438 |
7.1 | 0.0025 | NET NO AUTH LOW CX | Unauthenticated Cross Site Scripting (XSS) in Message Filter for Contact Form 7 | |
|
64
|
CVE-2026-65439 |
7.1 | 0.0025 | NET NO AUTH LOW CX | Unauthenticated Cross Site Scripting (XSS) in Ultimate Addons for Contact Form 7 | |
|
64
|
CVE-2026-65440 |
7.1 | 0.0025 | NET NO AUTH LOW CX | Unauthenticated Cross Site Scripting (XSS) in GetGenie <= 4.4.3 versions. | |
|
64
|
CVE-2026-65441 |
7.1 | 0.0025 | NET NO AUTH LOW CX | Unauthenticated Cross Site Scripting (XSS) in GiveWP <= 4.16.3 versions. | |
|
64
|
CVE-2026-65443 |
7.1 | 0.0025 | NET NO AUTH LOW CX | Unauthenticated Cross Site Scripting (XSS) in BackWPup <= 5.7.4 versions. | |
|
64
|
CVE-2026-65446 |
7.1 | 0.0025 | NET NO AUTH LOW CX | Unauthenticated Cross Site Scripting (XSS) in Kali Forms <= 2.4.18 versions. | |
|
64
|
CVE-2026-28082 |
7.1 | 0.0025 | NET NO AUTH LOW CX | Unauthenticated Cross Site Scripting (XSS) in JetEngine <= 3.8.13.1 versions. | |
|
64
|
CVE-2026-28143 |
7.1 | 0.0025 | NET NO AUTH LOW CX | Unauthenticated Cross Site Scripting (XSS) in Forminator <= 1.56.0 versions. | |
|
64
|
CVE-2026-28177 |
7.1 | 0.0025 | NET NO AUTH LOW CX | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti | |
|
64
|
CVE-2026-61961 |
7.1 | 0.0025 | NET NO AUTH LOW CX | Unauthenticated Cross Site Scripting (XSS) in EmbedPress <= 4.5.6 versions. | |
|
64
|
CVE-2026-61963 |
7.1 | 0.0025 | NET NO AUTH LOW CX | Unauthenticated Cross Site Scripting (XSS) in Media LIbrary Assistant <= 3.38 ve | |
|
64
|
CVE-2026-61964 |
7.1 | 0.0025 | NET NO AUTH LOW CX | Unauthenticated Cross Site Scripting (XSS) in Ninja Tables <= 5.2.9 versions. | |
|
64
|
CVE-2026-65513 |
7.1 | 0.0025 | NET NO AUTH LOW CX | Unauthenticated Cross Site Scripting (XSS) in Simply Schedule Appointments <= 1. | |
|
64
|
CVE-2026-65517 |
7.1 | 0.0025 | NET NO AUTH LOW CX | Unauthenticated Cross Site Scripting (XSS) in Easy PayPal Buy Now Button <= 2.0. | |
|
64
|
CVE-2026-65544 |
7.1 | 0.0025 | NET NO AUTH LOW CX | Unauthenticated Cross Site Scripting (XSS) in Super Socializer <= 7.14.5 version | |
|
64
|
CVE-2026-65545 |
7.1 | 0.0025 | NET NO AUTH LOW CX | Unauthenticated Cross Site Scripting (XSS) in AI Engine <= 3.6.8 versions. | |
|
64
|
CVE-2026-65560 |
7.1 | 0.0025 | NET NO AUTH LOW CX | Unauthenticated Cross Site Scripting (XSS) in Houzez Property Feed <= 2.5.48 ver | |
|
64
|
CVE-2026-65565 |
7.1 | 0.0025 | NET NO AUTH LOW CX | Unauthenticated Cross Site Scripting (XSS) in Survey Maker <= 5.2.3.3 versions. | |
|
64
|
CVE-2026-66439 |
7.1 | 0.0025 | NET NO AUTH LOW CX | Unauthenticated Cross Site Scripting (XSS) in Advanced AJAX Product Filters <= 3 | |
|
64
|
CVE-2026-66440 |
7.1 | 0.0025 | NET NO AUTH LOW CX | Unauthenticated Cross Site Scripting (XSS) in WPIDE – File Manager & Code Editor | |
|
64
|
CVE-2026-66457 |
7.1 | 0.0025 | NET NO AUTH LOW CX | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti | |
|
64
|
CVE-2026-66663 |
7.1 | 0.0025 | NET NO AUTH LOW CX | Unauthenticated Cross Site Scripting (XSS) in WP Data Access <= 5.5.79 versions. | |
|
64
|
CVE-2026-66664 |
7.1 | 0.0025 | NET NO AUTH LOW CX | Unauthenticated Cross Site Scripting (XSS) in SEO Plugin by Squirrly SEO <= 14.2 | |
|
64
|
CVE-2026-66690 |
7.1 | 0.0025 | NET NO AUTH LOW CX | Unauthenticated Cross Site Scripting (XSS) in GiveWP <= 4.16.5 versions. | |
|
64
|
CVE-2026-66694 |
7.1 | 0.0025 | NET NO AUTH LOW CX | Unauthenticated Cross Site Scripting (XSS) in Thrive Architect <= 10.9.3.1 versi | |
|
64
|
CVE-2026-66705 |
7.1 | 0.0025 | NET NO AUTH LOW CX | Unauthenticated Cross Site Scripting (XSS) in Facebook for WordPress <= 5.2.1 ve | |
|
64
|
CVE-2026-66707 |
7.1 | 0.0025 | NET NO AUTH LOW CX | Unauthenticated Cross Site Scripting (XSS) in Facebook for WooCommerce <= 3.7.5 | |
|
64
|
CVE-2026-66711 |
7.1 | 0.0025 | NET NO AUTH LOW CX | Subscriber Cross Site Scripting (XSS) in WooCommerce Multilingual & Multicurrenc | |
|
64
|
CVE-2026-27536 |
7.1 | 0.0025 | NET NO AUTH LOW CX | Unauthenticated Cross Site Scripting (XSS) in MailChimp Subscribe Forms <= 4.3. | |
|
64
|
CVE-2026-27539 |
7.1 | 0.0025 | NET NO AUTH LOW CX | Unauthenticated Cross Site Scripting (XSS) in Welcart e-Commerce <= 2.11.31 vers | |
|
64
|
CVE-2026-28003 |
7.1 | 0.0025 | NET NO AUTH LOW CX | Unauthenticated Cross Site Scripting (XSS) in Maspik – Spam blacklist <= 2.9.1 v | |
|
64
|
CVE-2026-28004 |
7.1 | 0.0025 | NET NO AUTH LOW CX | Unauthenticated Cross Site Scripting (XSS) in Business Directory <= 6.4.25 versi | |
|
64
|
CVE-2026-28158 |
7.1 | 0.0025 | NET NO AUTH LOW CX | Unauthenticated Cross Site Scripting (XSS) in Do Lasso <= 358 versions. | |
|
64
|
CVE-2026-28170 |
7.1 | 0.0025 | NET NO AUTH LOW CX | Unauthenticated Cross Site Scripting (XSS) in Blog Floating Button <= 1.4.20 ver | |
|
64
|
CVE-2026-28175 |
7.1 | 0.0025 | NET NO AUTH LOW CX | Unauthenticated Cross Site Scripting (XSS) in Visitors Traffic Real Time Statist | |
|
64
|
CVE-2026-28187 |
7.1 | 0.0025 | NET NO AUTH LOW CX | Unauthenticated Cross Site Scripting (XSS) in Knowledge Base for Documentation, | |
|
64
|
CVE-2026-61960 |
7.1 | 0.0025 | NET NO AUTH LOW CX | Unauthenticated Cross Site Scripting (XSS) in WP Full Stripe Free <= 8.5.0 versi | |
|
64
|
CVE-2026-61965 |
7.1 | 0.0025 | NET NO AUTH LOW CX | Unauthenticated Cross Site Scripting (XSS) in GeekyBot <= 1.2.6 versions. | |
|
64
|
CVE-2026-61974 |
7.1 | 0.0025 | NET NO AUTH LOW CX | Unauthenticated Cross Site Scripting (XSS) in Mang Board WP <= 2.3.4 versions. | |
|
64
|
CVE-2026-65580 |
7.1 | 0.0025 | NET NO AUTH LOW CX | Unauthenticated Cross Site Scripting (XSS) in Agrion <= 1.0.0 versions. | |
|
64
|
CVE-2026-66426 |
7.1 | 0.0025 | NET NO AUTH LOW CX | Unauthenticated Cross Site Scripting (XSS) in WP-Stats <= 2.56 versions. |